Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve code execution and shady links rules #463

Merged
merged 11 commits into from
Oct 4, 2024

Conversation

ikretz
Copy link
Contributor

@ikretz ikretz commented Oct 1, 2024

This PR makes some improvements to the code-execution and shady-links rules:

  • Adding a detection for subprocess.check_call() in code-execution
  • Making the https?:// prefix optional in shady-links links
  • Ignoring 169.254.0.0/16 and [fd00:ec2::254], which are cloud provider link-local IP ranges or addresses

@ikretz ikretz changed the title [SECRES-2215] Improve code execution and shady links rules [SECRES-2215] [SECRES-2450] Improve code execution and shady links rules Oct 1, 2024
@ikretz ikretz changed the title [SECRES-2215] [SECRES-2450] Improve code execution and shady links rules Improve code execution and shady links rules Oct 2, 2024
@ikretz ikretz marked this pull request as ready for review October 2, 2024 14:13
Copy link
Contributor

@christophetd christophetd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, would be good if @sobregosodd wanted to have a quick look as well

Copy link
Contributor

@sobregosodd sobregosodd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We discussed this one, LGTM!

@ikretz ikretz merged commit 40fd394 into main Oct 4, 2024
10 checks passed
@ikretz ikretz deleted the ikretz/code-execution-enhancement branch October 4, 2024 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants